I am lookin for a good example to illustrate this attack on NTRU using low parameters but I failed to do that, The attack consist to use LLL reduction on A basis of NTRU Lattice, let us use the column convention, how Can I use the first vector to retrieve (f,g)???

  • 2
    $\begingroup$ Isn't h, the public-key in NTRU? I think you're asking about (f,g) which belongs to R^2. $\endgroup$ Jun 3 '21 at 7:03
  • $\begingroup$ yeah thanks Mr @AaqibBashir $\endgroup$
    – Don Freecs
    Jun 3 '21 at 10:53
  • 1
    $\begingroup$ The column has $2N$ entries, so it is really a vector $(f', g') \in R^2$ (the first $N$ entries correspond to the $N$ coefficients of $f'$...). If your reduction is successful, then this column is short and the polynomial $f'$ that you get is the secret $f$ or a small multiple of $f$, which is usually already enough to decrypt the ciphertexts. $\endgroup$ Jun 3 '21 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.